I am trying to understand how the offset is calculated from ebp to esp in 32-bit.
My understanding is that when you push to the stack, esp is decremented and points to a lower address, 4 bytes at a time on 32-bit. I assumed that (ebp – 4) was right to get to a1fa1fa since that is decrementing–but then I did (esp + 4 + 4 + 4 + 4) to get offset of ebp from esp, which was incorrect.

How is it 28?